High severity · published Oct 28, 2025
CVE-2025-59837
Astro is a web framework that includes an image proxy
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Astro · Astro
5.13.4 before 5.13.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59837
Patch
https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4
Patch
https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
Exploit
https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2
More from Astro
7.5
CVE-2026-54299
Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)
6.5
CVE-2025-66202
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
6.5
CVE-2025-64525
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
6.5
CVE-2025-61925
Astro is a web framework
6.5
CVE-2024-56140
Bypass of CSRF Middleware in Astro